Tashan
The trusted directory for your AI's toolbox — and what agents actually pay for.
Demo
About
tashan scores the MCP servers and agent skills you can install into an AI agent, using public evidence only. 95,574 tracked, 12,662 with a published measurement: upkeep, freshness, adoption, and OSV advisories checked against the version you'd install today. Every number links to its source. Nobody can buy a rank. A test reads the scorer's source and fails the build if it touches anything that isn't public evidence. It also measures what agents actually pay for. Downloads and stars can be faked by the author, a payment can't. x402 makes those payments public, so we read the chain for every payment address in Coinbase's x402 directory — $247,356 settled across 10.4M payments, 998 of 1,079 services paid at least once. That directory publishes no evidence about any of them. A capability page shows whether a tool has ever been paid for, alongside whether it's maintained. `npx tashan-cli doctor` reads the agent configs on your machine — Claude Code, Desktop, Cursor, VS Code, Windsurf — and flags what's deprecated, archived, abandoned, or running an install script. Nothing uploaded.
How it's made
Python 3 stdlib, no dependencies. SQLite as the source of truth. Static site, no build step, strict CSP, on Cloudflare Pages — Functions for the paid endpoints, R2 for the DB cache, KV for licences. The Graph, two products: an x402 settlement subgraph on the Network, read through The Graph's Subgraph MCP server. The query is printed on the page so anyone can re-run it. Their documented client is an npx bridge, so we wrote an MCP client over HTTP+SSE in stdlib urllib — ~120 lines, no Node. We also shipped our own subgraph over the same economy: USDC Transfers on Base filtered on the indexed recipient, so graph-node matches at the log level and sync is bounded by the economy, not the chain. One query decision: we ask about every listed address in batches instead of ordering by volume and taking the top 1,000. A top-N query drops every service that earned almost nothing, and those rows matter. An address the chain doesn't know is reported as never paid, not omitted. Bazantic: published an OpenAPI spec for our endpoints, registered it as an x402/MPP gateway, and published a Recipe that returns install / caution / do-not-install for anything an agent is about to install. Security findings are not inputs to the score — "maintained" and "nothing known is wrong" are different claims, and merging them hides the package that scores 86 and runs an install script.